The nature of online commerce requires the collection of information from individuals to identify the parties to individual transactions, transfer funds for payment, and ensure the delivery of the goods or services being acquired. Public concern about the potential for abuse of such information by online merchants gave rise to the development of so-called "privacy policies" that provide a measure of reassurance that information collected will be protected from unauthorized use and disclosure. Such concerns come to a head when a merchant that sells online files for bankruptcy protection and then determines to sell off assets that include personally identifiable information.

Congress Responds to Toysmart

The case of In Re LLC illustrates the problem. Toysmart was an online toy store that found itself in financial difficulty and ceased operations. Thereafter, certain of its creditors filed a Chapter 11 involuntary petition against Toysmart to put it into bankruptcy. When Toysmart then moved to auction certain of its assets, including customer information, the Federal Trade Commission sued in federal district court alleging that the proposed sale violated the company's privacy policy and therefore was an unfair and deceptive trade practice. Although Toysmart reached a settlement with the FTC providing for limits on the disclosure of the customer information, including the types of companies to which it could be sold, and imposing other notification and consent requirements, the settlement was never approved by the bankruptcy court because a subsequent lawsuit by more than 40 states and other jurisdictions caused the proposed sale to be abandoned.

To address such concerns, Congress added provisions to the Bankruptcy Abuse Prevention and Consumer Protection Act (BAPCPA), enacted in 2005, to restrict certain transactions that may violate the privacy expectations of consumers.

Covered Information Defined

First, Congress identified an asset class of "personally identifiable information" to which restrictions would apply. See 11 U.S.C. § 101(41A). "Personally identifiable information" means an individual's name, residence address, email address, telephone number, Social Security number or credit card number, as well as an individual's birth date or other information that, if associated with the information in the prior list, would permit the identification or contacting of the individual.

To qualify for protection, such information must be provided to the debtor by the individual to whom it relates. Thus, protected information does not include information obtained from third parties. The information must also be provided "in connection with obtaining a product or service from the debtor." Thus, the protected information does not include information obtained from marketing activities, surveys, polls or the like. Finally, the information must be obtained in connection with a transaction that is "primarily for personal, family, or household purposes." In other words, it must have been obtained in connection with a consumer transaction rather than a business-to-business transaction.

Protective Procedure Established

Second, Congress amended Section 363 of the Bankruptcy Code, 11 U.S.C. § 363(b)(1), which governs the sale or lease of assets of a debtor's estate, to establish a process and standards for evaluating the potential sale or lease of such personally identifiable information. This process could apply, for example, to debtor assets such as customer lists or airline mileage records.

As amended, Section 363(b)(1) of the Bankruptcy Code provides that:

The trustee, after notice and a hearing, may use, sell, or lease, other than in the ordinary course of business, property of the estate, except that if the debtor in connection with offering a product or a service discloses to an individual a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor and if such policy is in effect on the date of the commencement of the case, then the trustee may not sell or lease personally identifiable information to any person unless;

(A) Such sale or such lease is consistent with such policy; or

(B) After appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale or such lease;

(i) Giving due consideration to the facts, circumstances, and conditions of such sale or such lease; and

(ii) Finding that no showing was made that such sale or such lease would violate applicable nonbankruptcy law.

Note that this limitation on the trustee's authority applies only to proposed transactions not "in the ordinary course of business." Thus, the process does not apply where it is the debtor's business to sell such information. Additionally, the debtor must have disclosed a privacy policy that restricts its ability to transfer the information in connection with the transaction during which the information was collected. Disclosure of a privacy policy is common in online transactions, but such a policy also may be disclosed in the course of face-to-face transactions. Finally, the privacy policy must be in effect on "the date of the commencement of the [bankruptcy] case." Although privacy policies that are changeable at will could theoretically be revoked shortly before making a bankruptcy filing, such an action might give rise to additional charges of unfair trade practices.

Where the triggering conditions are met, a bankruptcy court may authorize the proposed sale or lease of the information assets only if (i) the sale or lease is consistent with the debtor's privacy policy or (ii) the court finds, after appointment of a Consumer Privacy Ombudsman and a hearing, that the sale or lease should be approved notwithstanding the privacy policy under the particular facts and circumstances of the case and applicable non-bankruptcy law.

The Consumer Privacy Ombudsman

The Consumer Privacy Ombudsman is the key to the process established for review of Section 363 transactions involving personally identifiable information. As set out in Section 332 of the Bankruptcy Code, 11 U.S.C. § 332:

(a) If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint, not later than five days before the commencement of the hearing, one disinterested person (other than the United States trustee) to serve as the consumer privacy ombudsman in the case and shall require that notice of such hearing be timely given to such ombudsman.

(b) The consumer privacy ombudsman may appear and be heard at such hearing and shall provide to the court information to assist the court in its consideration of the facts, circumstances, and conditions of the proposed sale or lease of personally identifiable information under section 363(b)(1)(B). Such information may include presentation of:

The debtor's privacy policy;

The potential losses or gains of privacy to consumers if such sale or such lease is approved by the court;

The potential costs or benefits to consumers if such sale or such lease is approved by the court; and

The potential alternatives that would mitigate potential privacy losses or potential costs to consumers.

The role of the Consumer Privacy Ombudsman is to appear at the Section 363 hearing and advise the court concerning the privacy implications of the proposed transaction involving personally identifiable information. The Ombudsman is appointed by the United States Trustee and must not otherwise be involved or interested in the bankruptcy proceedings. Although the Ombudsman must be appointed at least five days before the hearing, in most cases it would be advisable to make the appointment much earlier in the process in order to allow the Ombudsman sufficient time to evaluate the proposed transaction and report to the court.

The Ombudsman's Task

The Ombudsman is charged with investigating the nature of the personally identifiable information involved in the transaction and understanding both how it is used in the debtor's business and its proposed use by the purchaser. He or she will further need to assess the impact of the proposed transaction on the privacy rights and expectations of affected consumers. To that end, the Ombudsman will explore questions such as, "What limitations does the debtor's privacy policy place on use and disclosure of the information?" and "What benefits will consumers enjoy from consummation of the proposed transaction?" For example, consumer purchasers of airline tickets on future flights could be severely disadvantaged if an acquiror of a debtor's airline business did not have access to the information necessary to permit it to honor the tickets.

The Ombudsman should understand the requirements of applicable privacy law, such as the Federal Trade Commission Act, state consumer protection statutes and specialized privacy legislation such as the Children's Online Privacy Protection Act (COPPA), the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA). He or she will be required to determine whether the information was collected consistent with such legal requirements as well as whether the proposed transaction is otherwise lawful. Then, based upon the investigation and analysis, the Ombudsman will submit a report advising the court concerning those specific matters, as well as any proposed conditions or limitations on the transferred information or its purchaser that appear necessary to warrant judicial approval of the transaction.

Implications for Transactions

In sum, both potential debtors and potential purchasers of distressed assets should be aware that proposed transactions involving personally identifiable information will be subject to increased judicial scrutiny and may be required to satisfy requirements in addition to those typical of bankruptcy sales in order to secure the necessary bankruptcy court approval. Time will tell how the foregoing statutory concepts are construed by bankruptcy courts in the context of specific proposed transactions and whether the transfer of potential personally identifiable information is materially impeded or significantly conditioned.